Security checks across malware telemetry and agentic risk
The skill appears to provide the advertised DMP audience-insight workflow, but it uses sensitive API credentials, dynamically finds and runs another local skill's Python script, and persists business task/result data in ways users should review carefully.
Install only if you trust the publisher and the companion auth/logger skills. Use narrowly scoped API credentials, rotate them if pasted into chat, check where result and history files are written, and avoid running this in a workspace where untrusted skills or files could masquerade as the auth helper.
# 调用鉴权技能的API脚本
try:
result = subprocess.run(
["python3", str(auth_skill_path), "POST", endpoint, json.dumps(request_body)],
capture_output=True,
text=True,# 调用鉴权技能的API脚本（正确的endpoint路径，不包含/api/open-api前缀）
try:
result = subprocess.run(
[
"python3",
str(auth_skill_path),65/65 vendors flagged this skill as clean.